SynAssert: Automated Synthesis of CSCA Leakage Patterns into Cost-Effective Security Assertions

Cache timing Side-Channel Attacks (CSCAs) exploit timing variations in consecutive memory accesses to a single cache block, known as Leakage Patterns (LPs), to access sensitive data. Although LPs are not direct attacks, the information they expose can facilitate CSCAs. Meltdown, Spectre and modern attacks leverage this leaked information, highlighting the importance of awareness of these patterns. This paper introduces the SynAssert framework, which automatically synthesizes state-of-the-art LPs into SystemVerilog Security Assertions (SAs) to detect CSCAs at the Register-Transfer Level. Experimental results show that SynAssert detects all known CSCAs with 100% accuracy, generating a minimal number of SAs automatically. These assertions are then transformed into hardware checkers, which incur acceptable overhead in terms of area and power consumption, and exhibit a lower false positive rate compared to existing methods.